Skip to content

December 2022


  • I had a lot of fun with Datasette in December.
    • This is a tool that got added to my Toolbox for sure: it's awesome and rather versatile.
  • I took a quick look at no-code development with AppSheet.
  • I improved my tools for authentication-related testing.
  • I have some new favorite free web development resources:
  • I have some new favorite free Kubernetes development resources: Okteto and Krucible are among my favorites.
  • A few quick notes from the Implement DevOps in Google Cloud course and the Cloud SQL quest. CodeLabs
  • I'm taking notes as I start working through Building Git: it's fantastic so far and came highly recommended by a trusted colleague.
  • one last blog post:





Read more on my Authentication page.

Unsolicited SAML responses AKA IdP-initiated SSO

SAML Python toolkit lets you turn your Python application into a SP (Service Provider) that can be connected to an IdP (Identity Provider).

In production also we highly recommend to register on the settings the IdP certificate instead of using the fingerprint method. The fingerprint, is a hash, so at the end is open to a collision attack that can end on a signature validation bypass. Other SAML toolkits deprecated that mechanism, we maintain it for compatibility and also to be used on test environment.

Hashing algorithms:

OneLogin SAML toolkits work with AD-FS. In order to ensure they work properly, make sure you select SHA1 instead of SHA256 as the hashing algorithm in AD-FS.




I'm looking for more good examples of SAML SPs that meet these criteria:

  • are free/have a free tier
  • can be self-hosted (not a hard requirement)

So far, the options that seem to meet my requirements are:

A place to look (that's mostly paid):

There's also:

Custom Executors for GitLab Runner